WooYun.org

public function login_save(){
		$username = safe_html($_POST['username']);//获取UserName，通过safe_html进行过滤，这里存在缺陷，可绕过限制，进行注入
		$password = safe_html($_POST['password']);
		
		if(empty($username)||empty($password)){
			showmsg(C('user_pass_empty'),'-1');
		}
		
		$sql="select * from ".DB_PRE."member where `username`='$username'";//通过绕过限制，在这里进行注入
		if($this->mysql->num_rows($sql)==0){
			showmsg(C('member_not_exist'),'-1');
		}
		
		$password=md5(md5($password));
		$rs=$this->mysql->get_one($sql);
		if($password!=$rs['password']){
			showmsg(C('password_error'),'-1');
		}
		
		if($rs['is_lock']==1){
			showmsg(C('user_lock'),'-1');
		}
		
		$logins=$rs["logins"]+1;
		$ip=safe_replace(safe_html(getip()));
		$this->mysql->db_update("member","`last_ip`='".$ip."',`last_time`=".datetime().",`logins`=".$logins,"`username`='$username'");
		
		Cookie::_setcookie(array('name'=>'member_user','value'=>$username));
		Cookie::_setcookie(array('name'=>'member_userid','value'=>$rs['userid']));
		Cookie::_setcookie(array('name'=>'member_groupid','value'=>$rs['groupid']));
		unset($rs);
		showmsg(C("login_success"),"index.php?m=member");
	}